CPA firm disaster recovery: uptime, backups and remote access before April 15

Why does uptime matter more in the last week before April 15?

Because the deadline does not move when your systems go down. Under 26 U.S.C. 6072(a) calendar-year income tax returns are due on or before April 15, and in 2027 that date falls on a Thursday. A ransomware event, a failed server or a broken remote connection in the final week turns into missed filings, rushed extensions and difficult client calls. That is why CPA firm disaster recovery has to be built around the filing calendar.

The IRS gives e-file providers very little slack. Publication 1345 says an Electronic Return Originator must transmit a return received on or before the due date by the due date, and treats waiting more than three calendar days to submit a return, once the ERO has everything it needs, as stockpiling. If a return is rejected and the firm cannot fix it, the ERO must take reasonable steps to tell the taxpayer within 24 hours.

Those rules assume your tax software, your file server and your people can all reach each other. The rest of this article covers the three things that most often break that chain in a small or midsize CPA firm: system availability, backups and remote access.

What happens if a return is rejected right at the deadline?

A rejected return can still be timely if you act fast. Publication 1345 treats a return filed electronically by the due date and later rejected as timely if the electronic portion is corrected and resubmitted by the fifth calendar day after the due date. If the firm does not resubmit electronically, the taxpayer must file on paper by the later of the due date or ten calendar days after the IRS notice.

That five-day window is short. If your tax software, document storage or remote access is down for the week after April 15, the window can close before anyone can open the client file to fix the error. Rejection handling is an uptime problem as much as a tax problem.

Extensions follow the same logic. IRS Tax Topic 304 says individuals can request up to six more months to file, but the request has to be made by the return's due date, and an extension of time to file is not an extension of time to pay. A firm that loses its systems on April 14 still needs a working path to transmit Form 4868 or mail it.

Which rules already require a plan for outages and recovery?

The FTC Safeguards Rule is the main one. 16 CFR 314.2 lists tax preparation firms as financial institutions, and 16 CFR 314.4(h) requires a written incident response plan designed to promptly respond to, and recover from, any security event materially affecting the confidentiality, integrity or availability of customer information.

Availability is the word that matters for April. A ransomware event that encrypts your file server may never expose a single return, but it still affects availability, so it falls inside the plan the rule requires. The rule also lists what the plan must address, including:

• The internal processes for responding to a security event.
• Clear roles, responsibilities and levels of decision-making authority.
• External and internal communications and information sharing.
• Evaluation and revision of the plan after a security event.

One exception matters for smaller practices. Under 16 CFR 314.6, the written incident response plan requirement does not apply to a firm that maintains customer information on fewer than 5,000 consumers. A written plan is still the practical way to meet the IRS continuity expectations below.

The IRS points the same way. Publication 4557, Safeguarding Taxpayer Data, tells tax professionals to "develop a continuity plan" and to back up data so that a data loss or ransomware attack will not destroy all files. Publication 1345 adds a reporting clock: providers must report security incidents to the IRS no later than the next business day after confirming the incident. Our guide to reporting data theft to the IRS Stakeholder Liaison covers that step.

How should a tax practice back up client data during filing season?

Back up often, keep at least one copy offline and encrypted, and prove you can restore it. Publication 4557 suggests considering a monthly backup schedule, "or more often during the filing season," backing up to a secure external source not connected full time to the network, and encrypting backed-up files, including before uploading to the cloud.

CISA guidance adds the step firms most often skip: testing. The #StopRansomware Guide (September 2023) recommends offline, encrypted backups of critical data and regular testing of the availability and integrity of backups in a disaster recovery scenario. It also recommends keeping updated "golden images" of critical systems so they can be rebuilt quickly.

For a tax practice, the practical questions are:

• How much preparer work can you afford to redo? If you back up nightly, a failure costs at most a day. Weekly backups can cost a week of returns in April.
• What exactly is backed up? Tax software databases, client document folders, the portal export, scanned source documents and the e-file transmission records all need coverage.
• Can ransomware reach the backup? A backup drive that stays mapped to the server, or a cloud sync folder, can be encrypted along with everything else.
• How long does a full restore take? If restoring the tax server takes three days, a failure on April 12 means returns cannot be finished on time.

What does secure remote access need to look like during busy season?

Remote access has to be both secure and reliable, because busy season is when partners work evenings from home and seasonal staff log in from wherever they are. Publication 4557 describes multi-factor authentication and a secure virtual private network as minimum standards for remote access to a firm's office network.

The Safeguards Rule sets the same floor in 16 CFR 314.4(c)(5): multi-factor authentication for any individual accessing any information system, unless the Qualified Individual approves in writing a reasonably equivalent or more secure control. Our checklist on closing MFA gaps before tax season walks through where firms usually miss coverage.

Reliability is the part firms tend to skip. A single VPN appliance or a single remote desktop server becomes a single point of failure in April. If that box fails, every remote preparer stops at once. Zero trust network access tools that connect users to specific applications, with access that expires for seasonal staff, remove some of that dependency. We cover the setup in how to give seasonal staff zero trust access that expires.

What should a CPA firm disaster recovery plan include before April 15, 2027?

It should include tested restores, an offline backup, a second way in for remote staff and named decision-makers, and the months before filing season are the time to test them. A practical sequence:

• Write down your recovery targets: how many hours the tax software can be down and how much work you can lose, for the weeks before April 15 and for the rest of the year.
• Run a full restore of the tax server and client files to a clean machine, time it, and fix whatever made it slow.
• Confirm at least one backup copy is offline or immutable and encrypted, and that ransomware on a workstation cannot reach it.
• Check that every remote access path requires MFA, and identify a second way in if the primary VPN or remote desktop server fails.
• Decide who can declare an outage, who calls clients, and how the firm will transmit extensions and fix rejected returns if the main system is down. Put those names in the incident response plan.
• Freeze non-essential changes, such as major upgrades and server moves, from mid-March through April 15.
• Update your written information security plan so it matches what you actually do. Our guide to updating your WISP before the 2027 filing season covers the rest of that document.

Each of these produces evidence: a restore log, a signed plan, an access review. That record helps show how the firm meets the Safeguards Rule's written plan and testing requirements if a client, insurer or regulator asks.

How can s90 help?

s90 supports CPA and tax firms across Los Angeles and Orange County with managed IT built around the filing calendar: monitored and tested backups, MFA and zero trust remote access, and an incident response plan aligned to the FTC Safeguards Rule and IRS Publication 4557. If you want a second set of eyes on your restore times or remote access before January, we are happy to talk it through.